Cloudsmith Changelog

Client log exports now contain the format-specific metadata requests your toolchain makes, so you can see the full request chain behind a download…

Exemptions defined in cooldown policies let specific packages skip the cooldown period and become available immediately, so a new release that fixes a vulnerability doesn’t have to wait. Exempt packages are still evaluated against your other active policies, and any action those policies define still applies…

Vulnerability records now show how likely each vulnerability is to be exploited, so you can order a backlog of High and Critical findings by what’s likely to be attacked, not just by severity…

Cloudsmith’s npm client support now serves npm's attestations and signing keys APIs, so provenance verification works through Cloudsmith just as it does when connecting directly to the upstream registry…

The Cloudsmith CLI now sends anonymous reports of unexpected errors to Cloudsmith by default, so we can find and fix crashes without waiting for a support ticket. It also connects through Transport Layer Security (TLS) intercepting proxies without turning off certificate verification, and installs credential helpers where package-manager upgrades can't remove them. Username and password login with 'cloudsmith' login and 'cloudsmith token' is deprecated and stops working on November 20, 2026…

Store artifacts closer to your users and CI/CD pipelines in India, so downloads are faster…

Cloudsmith now supports ActiveState Curated Catalog upstreams, with configuration built into the Libraries tab…

The Cloudsmith CLI now authenticates from Buildkite pipelines and Google Cloud workloads with OpenID Connect (OIDC), so no Cloudsmith API key needs to live on your build hosts. It can also list packages from connected repositories alongside your own…

You can now apply cooldown policies to Ruby gem packages, protecting your supply chain from newly published versions that may carry malware or have not yet undergone sufficient community scrutiny…

A new validate endpoint returns syntax and type errors in Rego policy logic without creating or updating anything, so you can fix them before you submit…